approval-engine/tests/test_examples.py

"""The published examples must satisfy the published schema.

flex-auth shipped two defects in one day from fixtures that contradicted their
own contracts, and secrets-engine built a validator against one of them. A
contract whose examples contradict its prose will be implemented as its
examples, so the examples are tested rather than trusted.
"""

import json
from pathlib import Path

import pytest

jsonschema = pytest.importorskip("jsonschema")

ROOT = Path(__file__).resolve().parent.parent
SCHEMA = json.loads((ROOT / "schemas" / "approval_claim.schema.json").read_text())
EXAMPLES = sorted((ROOT / "examples").glob("claim.*.json"))


def test_examples_exist():
    assert EXAMPLES, "no claim examples found to validate"


@pytest.mark.parametrize("path", EXAMPLES, ids=lambda p: p.name)
def test_example_matches_schema(path):
    jsonschema.validate(json.loads(path.read_text()), SCHEMA)


@pytest.mark.parametrize("path", EXAMPLES, ids=lambda p: p.name)
def test_example_states_pdp_digest_explicitly(path):
    """Absence must be a stated null, never a missing key."""
    assert "pdp_digest" in json.loads(path.read_text())["binding"]


def test_examples_cover_both_pdp_binding_states():
    """An implementer must see both shapes, not infer one from the other."""
    states = {
        json.loads(p.read_text())["binding"]["pdp_digest"] is None for p in EXAMPLES
    }
    assert states == {True, False}


def test_examples_cover_both_pdp_path_declarations():
    states = {json.loads(p.read_text())["binding"]["pdp_path"] for p in EXAMPLES}
    assert states == {True, False}


def test_pdp_binding_is_not_confounded_with_validity():
    """Both shapes present is not enough if they only ever co-vary.

    With only `claim.valid` (pdp_digest set, pdp_path true) and `claim.revoked`
    (null, false), the two dimensions are perfectly correlated and an
    implementer can reasonably infer that pdp_digest is null *because* the claim
    is revoked, or that pdp_path tracks validity. Both inferences are wrong and
    the example set is what teaches them.

    The shape that must exist is a claim that is entirely valid -- `valid_now`
    true, `reason_code` ok, not consumed -- and still carries no PDP binding.
    That is the claim a privileged-lane PEP MUST refuse under
    `GH-DEC-2026-008`, and it is the one a consumer would otherwise have to
    invent a fixture for.
    """
    claims = [json.loads(p.read_text()) for p in EXAMPLES]
    valid_without_pdp = [
        c
        for c in claims
        if c["valid_now"]
        and c["reason_code"] == "ok"
        and not c["consumed"]
        and c["binding"]["pdp_digest"] is None
        and c["binding"]["pdp_path"] is False
    ]
    assert valid_without_pdp, (
        "no example of a valid claim with no PDP binding; a consumer writing the "
        "privileged-lane refusal has no published shape to test against"
    )


def test_valid_claims_cover_both_pdp_path_declarations():
    """The decorrelation stated as coverage rather than as one instance."""
    paths = {
        c["binding"]["pdp_path"]
        for c in (json.loads(p.read_text()) for p in EXAMPLES)
        if c["valid_now"]
    }
    assert paths == {True, False}, (
        f"valid examples declare only pdp_path={paths}; both are reachable states "
        "for a valid approval"
    )


@pytest.mark.parametrize("path", EXAMPLES, ids=lambda p: p.name)
def test_pdp_path_examples_always_carry_a_digest(path):
    """GH-DEC-2026-008: pdp_path true guarantees pdp_digest non-null."""
    binding = json.loads(path.read_text())["binding"]
    if binding["pdp_path"]:
        assert binding["pdp_digest"] is not None